Re: How can I secure a Debian installation?

2014-01-30 Brian <ad44@cityscape.co.uk>:

On Thu 30 Jan 2014 at 18:53:11 +0100, Denis Witt wrote:

> On Tue, 28 Jan 2014 18:42:34 +0000
> Brian <ad44@cityscape.co.uk> wrote:
>
> > The AllowUsers directive is a legitimate way to restrict ssh logins to
> > certain users. However, I do not see what (ssh keys + AllowUsers)
> > brings to the party that (password + AllowUsers) doesn't.
>
> A key (if kept secret) is even harder to "guess" than a
> password,

I'd like to see a complex, random, high-entropy 20 character password
which is guessable (or capable of being cracked) in a timeframe which
has some significance. I'll give you "even harder" but it is of no great
consequence if you consider the situation where an online subversion of
a user's account is being attempted and a good password is in place.

I'd like to see someone who use such 20 character password for everyday tasks.

> also it's not "ssh keys + AllowUsers" it's (or should be)
> "ssh key + key pass-phrase + AllowUsers".

The key pass-phrase is never seen by the server; it plays no part in an
ssh login. You may think it does but the server doesn't.

It's not the passphrase indeed, as I replied to you the key must exist.

No key, no authentication process even begins, simply: password it's not even being asked.

ssh keys + AllowUsers

and

password + AllowUsers

are equally as secure.

Passwords are guessable and brute force are here to stay. But can you show me how to simulate the presence of a key on a client side?

Allowusers does what it says. It may be a requirement of the site being
accesssed but it plays no part in the security underlying an ssh login,

There are security advantages to logging in with ssh keys; the strength
of a key isn't one of them. However, ssh key proponents never seem to
mention them. They instruct: "Use private key authentication"; no
explanation, no justification, nothing to indicate why it might be more
appropriate for the situation under discussion. It's as though they are
mesmerised by the number of bits which a key can contain.

It's quite strange you can't get the concept behind.

Nobody instructs, ssh man pages do. Private keys are there and easy to understand if you are willing to.

To return to the original point of this thread: logging in as root with
a key or with a password carries the same risk. I would say it is close
to zero in both cases.